{ "schemas": [ { "packageName": "@backstage/cli", "value": { "$schema": "https://backstage.io/schema/config-v1", "title": "@backstage/cli", "type": "object", "properties": { "app": { "type": "object", "properties": { "baseUrl": { "type": "string", "visibility": "frontend" }, "title": { "type": "string", "visibility": "frontend" }, "datadogRum": { "type": "object", "description": "Datadog RUM events configuration", "properties": { "env": { "type": "string", "visibility": "frontend", "description": "Environment for Datadog RUM events" }, "clientToken": { "type": "string", "visibility": "frontend", "description": "clientToken for Datadog RUM events" }, "applicationId": { "type": "string", "visibility": "frontend", "description": "applicationId for Datadog RUM events" }, "site": { "type": "string", "visibility": "frontend", "description": "site for Datadog RUM events" }, "sessionSampleRate": { "type": "number", "visibility": "frontend", "description": "sample rate of Datadog RUM events" }, "sessionReplaySampleRate": { "type": "number", "visibility": "frontend", "description": "sample rate of session replays based upon already sampled Datadog RUM events" } }, "required": [ "clientToken", "applicationId" ] }, "listen": { "type": "object", "description": "Listening configuration for local development", "properties": { "host": { "type": "string", "visibility": "frontend", "description": "The host that the frontend should be bound to. Only used for local development." }, "port": { "type": "number", "visibility": "frontend", "description": "The port that the frontend should be bound to. Only used for local development." } } }, "https": { "type": "object", "description": "Only used for local development. The https object is passed to webpack in order to enable using https on localhost.", "properties": { "certificate": { "type": "object", "description": "Parent object containing certificate and the private key", "required": [ "key", "cert" ], "properties": { "key": { "type": "string", "visibility": "secret", "description": "Https Certificate private key. Use $file to load in a file" }, "cert": { "type": "string", "visibility": "secret", "description": "Https Certificate. Use $file to load in a file" } } } } } } } } }, "path": "../cli/package.json" }, { "path": "../core-app-api/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "app": { "type": "object", "properties": { "baseUrl": { "type": "string", "description": "The public absolute root URL that the frontend.", "visibility": "frontend" }, "title": { "type": "string", "description": "The title of the app, as shown in the Backstage web interface.", "visibility": "frontend" }, "support": { "type": "object", "properties": { "url": { "type": "string", "description": "The primary support url.", "visibility": "frontend" }, "items": { "type": "array", "items": { "type": "object", "properties": { "title": { "type": "string", "description": "The title of the support item grouping.", "visibility": "frontend" }, "icon": { "type": "string", "description": "An optional icon for the support item grouping.", "visibility": "frontend" }, "links": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string", "visibility": "frontend" }, "title": { "type": "string", "visibility": "frontend" } }, "required": [ "url" ] }, "description": "A list of support links for the Backstage instance inside this grouping." } }, "required": [ "title", "links" ] }, "description": "A list of categorized support item groupings." } }, "required": [ "url", "items" ], "description": "Information about support of this Backstage instance and how to contact the integrator team." }, "routes": { "type": "object", "properties": { "bindings": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "boolean", "const": false } ] }, "description": "Maps external route references to regular route references. Both the key and the value is expected to be on the form `.`. If the value is `false`, the route will be disabled even if it has a default mapping.", "deepVisibility": "frontend" } } } }, "required": [ "baseUrl" ], "description": "Generic frontend configuration." }, "backend": { "type": "object", "properties": { "baseUrl": { "type": "string", "description": "The public absolute root URL that the backend is reachable at, from the browser's perspective.", "visibility": "frontend" } }, "required": [ "baseUrl" ], "description": "Generic backend configuration." }, "organization": { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the organization that the app belongs to.", "visibility": "frontend" } }, "description": "Configuration that provides information about the organization that the app is for." }, "homepage": { "type": "object", "properties": { "clocks": { "type": "array", "items": { "type": "object", "properties": { "label": { "type": "string", "visibility": "frontend" }, "timezone": { "type": "string", "visibility": "frontend" } }, "required": [ "label", "timezone" ] } } }, "description": "This config was used by the HomepageTimer but has been replaced by the HeaderWorldClock in the home plugin", "deprecated": "in favor of the HeaderWorldClock which is found in the home plugin" }, "auth": { "type": "object", "properties": { "environment": { "type": "string", "description": "The 'environment' attribute added as an optional parameter to have configurable environment value for `auth.providers`. default value: 'development' optional values: 'development' | 'production'", "visibility": "frontend" } }, "description": "Configuration that provides information on available configured authentication providers." }, "enableExperimentalRedirectFlow": { "type": "boolean", "description": "Enable redirect authentication flow type, instead of a popup for authentication.", "visibility": "frontend" }, "discovery": { "type": "object", "properties": { "endpoints": { "type": "array", "items": { "type": "object", "properties": { "target": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "external": { "type": "string", "visibility": "frontend" } } } ], "description": "The target baseUrl to use for the plugin\n\nCan be either a string or an object with internal and external keys. (Internal is used for the backend, external for the frontend) Targets with `{{pluginId}}` or `{{ pluginId }} in the url will be replaced with the pluginId.", "visibility": "frontend" }, "plugins": { "type": "array", "items": { "type": "string" }, "description": "Array of plugins which use the target baseUrl. Use `'*'` to configure a fallback target for all plugins without an explicit target.", "visibility": "frontend" } }, "required": [ "target", "plugins" ] }, "description": "Endpoints\n\nA list of target baseUrls and the associated plugins.", "visibility": "frontend" } }, "description": "Discovery options.", "visibility": "frontend" } }, "required": [ "app", "backend" ] }, "packageName": "@backstage/core-app-api" }, { "path": "../core-components/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "auth": { "type": "object", "properties": { "autologout": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Enable or disable the autologout feature", "visibility": "frontend" }, "idleTimeoutMinutes": { "type": "number", "description": "Number of minutes after which the inactive user is logged out automatically. Default is 60 minutes (1 hour)", "visibility": "frontend" }, "promptBeforeIdleSeconds": { "type": "number", "description": "Number of seconds before the idle timeout where the user will be asked if it's still active. A dialog will be shown. Default is 10 seconds. Set to 0 seconds to disable the prompt.", "visibility": "frontend" }, "useWorkerTimers": { "type": "boolean", "description": "Enable/disable the usage of worker thread timers instead of main thread timers. Default is true. If you experience some browser incompatibility, you may try to set this to false.", "visibility": "frontend" }, "logoutIfDisconnected": { "type": "boolean", "description": "Enable/disable the automatic logout also on users that are logged in but with no Backstage tabs open. Default is true.", "visibility": "frontend" } }, "description": "Autologout feature configuration" } } } } }, "packageName": "@backstage/core-components" }, { "path": "../../plugins/permission-common/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "permission": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether authorization is enabled in Backstage. Defaults to false, which means authorization requests will be automatically allowed without invoking the authorization policy.", "visibility": "frontend" }, "EXPERIMENTAL_enableBatchedRequests": { "type": "boolean", "visibility": "frontend" } }, "description": "Configuration options for Backstage permissions and authorization" } } }, "packageName": "@backstage/plugin-permission-common" }, { "path": "../../plugins/techdocs/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "techdocs": { "type": "object", "properties": { "builder": { "type": "string", "enum": [ "local", "external" ], "description": "Documentation building process depends on the builder attr", "visibility": "frontend" }, "legacyUseCaseSensitiveTripletPaths": { "type": "boolean", "description": "Allows fallback to case-sensitive triplets in case of migration issues.", "visibility": "frontend" }, "sanitizer": { "type": "object", "properties": { "allowedIframeHosts": { "type": "array", "items": { "type": "string" }, "description": "Allows iframe tag only for listed hosts Example: allowedIframeHosts: [\"example.com\"] this will allow all iframes with the host `example.com` in the src attribute", "visibility": "frontend" }, "allowedCustomElementTagNameRegExp": { "type": "string", "description": "Allows listed custom element tag name regex Example: allowedCustomElementTagNameRegExp: '^backstage-' this will allow all custom elements with tag name matching `^backstage-` like etc.", "visibility": "frontend" }, "allowedCustomElementAttributeNameRegExp": { "type": "string", "description": "Allows listed custom element attribute name regex Example: allowedCustomElementAttributeNameRegExp: 'attribute1|attribute2' this will allow all custom element attributes matching `attribute1` or `attribute2` like ", "visibility": "frontend" }, "additionalAllowedURIProtocols": { "type": "array", "items": { "type": "string" }, "description": "Allows listed protocols in attributes with URI values Example: additionalAllowedURIProtocols: ['vscode'] this will allow all attributes with URI values to have `vscode` protocol like `vscode://some/path` in addition to the default protocols matched by DOMPurify's IS_ALLOWED_URI RegExp:", "visibility": "frontend" } } } }, "description": "Configuration options for the techdocs plugin" } } }, "packageName": "@backstage/plugin-techdocs" }, { "path": "../integration/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "integrations": { "type": "object", "properties": { "azure": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The hostname of the given Azure instance", "visibility": "frontend" }, "credentials": { "type": "array", "items": { "type": "object", "properties": { "organizations": { "type": "array", "items": { "type": "string" } }, "clientId": { "type": "string" }, "clientSecret": { "type": "string", "visibility": "secret" }, "tenantId": { "type": "string" }, "personalAccessToken": { "type": "string", "visibility": "secret" }, "managedIdentityClientId": { "type": "string" } } }, "description": "The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used. If no organization matches the first credential without an organization is used.\n\nIf no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used." }, "commitSigningKey": { "type": "string", "description": "PGP signing key for signing commits.", "visibility": "secret" } }, "required": [ "host" ] }, "description": "Integration configuration for Azure" }, "azureBlobStorage": { "type": "array", "items": { "type": "object", "properties": { "accountName": { "type": "string", "description": "The name of the Azure Storage Account, e.g., \"mystorageaccount\"." }, "accountKey": { "type": "string", "description": "The primary or secondary key for the Azure Storage Account. Only required if connectionString or SAS token are not specified.", "visibility": "secret" }, "sasToken": { "type": "string", "description": "A Shared Access Signature (SAS) token for limited access to resources.", "visibility": "secret" }, "connectionString": { "type": "string", "description": "A full connection string for the Azure Storage Account. This includes the account name, key, and endpoint details.", "visibility": "secret" }, "endpointSuffix": { "type": "string", "description": "Optional endpoint suffix for custom domains or sovereign clouds. e.g., \"core.windows.net\" for public Azure or \"core.usgovcloudapi.net\" for US Government cloud." }, "endpoint": { "type": "string", "description": "Optional endpoint URL for custom domain. Uses default if not provided.", "visibility": "frontend" }, "aadCredential": { "type": "object", "properties": { "clientId": { "type": "string", "description": "The client ID of the Azure AD application." }, "tenantId": { "type": "string", "description": "The tenant ID for Azure AD." }, "clientSecret": { "type": "string", "description": "The client secret for the Azure AD application.", "visibility": "secret" } }, "required": [ "clientId", "tenantId", "clientSecret" ], "description": "Optional credential to use for Azure Active Directory authentication." } } }, "description": "Integration configuration for Azure Blob Storage" }, "bitbucketCloud": { "type": "array", "items": { "type": "object", "properties": { "username": { "type": "string", "description": "The username to use for authenticated requests." }, "token": { "type": "string", "description": "Token used to authenticate requests.", "visibility": "secret" }, "appPassword": { "type": "string", "description": "Bitbucket Cloud app password used to authenticate requests.", "visibility": "secret", "deprecated": "Use `token` instead." }, "clientId": { "type": "string", "description": "OAuth client ID for Bitbucket Cloud.", "visibility": "secret" }, "clientSecret": { "type": "string", "description": "OAuth client secret for Bitbucket Cloud.", "visibility": "secret" }, "commitSigningKey": { "type": "string", "description": "PGP signing key for signing commits.", "visibility": "secret" } } }, "description": "Integration configuration for Bitbucket Cloud" }, "bitbucketServer": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The hostname of the given Bitbucket Server instance", "visibility": "frontend" }, "token": { "type": "string", "description": "Token used to authenticate requests.", "visibility": "secret" }, "username": { "type": "string", "description": "Username used to authenticate requests with Basic Auth.", "visibility": "secret" }, "password": { "type": "string", "description": "Password (or token as password) used to authenticate requests with Basic Auth.", "visibility": "secret" }, "apiBaseUrl": { "type": "string", "description": "The base url for the Bitbucket Server API, for example https:///rest/api/1.0", "visibility": "frontend" }, "commitSigningKey": { "type": "string", "description": "PGP signing key for signing commits.", "visibility": "secret" } }, "required": [ "host" ] }, "description": "Integration configuration for Bitbucket Server" }, "gerrit": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The hostname of the given Gerrit instance", "visibility": "frontend" }, "baseUrl": { "type": "string", "description": "The base url for the Gerrit instance.", "visibility": "frontend" }, "gitilesBaseUrl": { "type": "string", "description": "The gitiles base url.", "visibility": "frontend" }, "cloneUrl": { "type": "string", "description": "The base url for cloning repos.", "visibility": "frontend" }, "disableEditUrl": { "type": "boolean", "description": "Disable the edit url feature.", "visibility": "frontend" }, "username": { "type": "string", "description": "The username to use for authenticated requests.", "visibility": "secret" }, "password": { "type": "string", "description": "Gerrit password used to authenticate requests. This can be either a password or a generated access token.", "visibility": "secret" }, "commitSigningKey": { "type": "string", "description": "PGP signing key for signing commits.", "visibility": "secret" } }, "required": [ "host", "gitilesBaseUrl" ] }, "description": "Integration configuration for Gerrit" }, "github": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The hostname of the given GitHub instance", "visibility": "frontend" }, "token": { "type": "string", "description": "Token used to authenticate requests.", "visibility": "secret" }, "apiBaseUrl": { "type": "string", "description": "The base url for the GitHub API, for example https://api.github.com", "visibility": "frontend" }, "rawBaseUrl": { "type": "string", "description": "The base url for GitHub raw resources, for example https://raw.githubusercontent.com", "visibility": "frontend" }, "apps": { "type": "array", "items": { "type": "object", "properties": { "appId": { "type": [ "number", "string" ], "description": "The numeric GitHub App ID, string for environment variables" }, "privateKey": { "type": "string", "description": "The private key to use for auth against the app", "visibility": "secret" }, "webhookSecret": { "type": "string", "description": "The secret used for webhooks", "visibility": "secret" }, "clientId": { "type": "string", "description": "The client ID to use" }, "clientSecret": { "type": "string", "description": "The client secret to use", "visibility": "secret" }, "allowedInstallationOwners": { "type": "array", "items": { "type": "string" }, "description": "List of installation owners allowed to be used by this GitHub app. The GitHub UI does not provide a way to list the installations. However you can list the installations with the GitHub API. You can find the list of installations here: https://api.github.com/app/installations The relevant documentation for this is here. https://docs.github.com/en/rest/reference/apps#list-installations-for-the-authenticated-app--code-samples" }, "publicAccess": { "type": "boolean", "description": "If true, then an installation token will be issued for access when no other token is available." } }, "required": [ "appId", "privateKey", "clientId", "clientSecret" ] }, "description": "GitHub Apps configuration" } }, "required": [ "host" ] }, "description": "Integration configuration for GitHub" }, "gitlab": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The host of the target that this matches on, e.g. \"gitlab.com\".", "visibility": "frontend" }, "apiBaseUrl": { "type": "string", "description": "The base URL of the API of this provider, e.g. \"https://gitlab.com/api/v4\", with no trailing slash.\n\nMay be omitted specifically for public GitLab; then it will be deduced.", "visibility": "frontend" }, "token": { "type": "string", "description": "The authorization token to use for requests to this provider.\n\nIf no token is specified, anonymous access is used.", "visibility": "secret" }, "baseUrl": { "type": "string", "description": "The baseUrl of this provider, e.g. \"https://gitlab.com\", which is passed into the GitLab client.\n\nIf no baseUrl is provided, it will default to https://${host}.", "visibility": "frontend" }, "commitSigningKey": { "type": "string", "description": "PGP signing key for signing commits.", "visibility": "secret" }, "retry": { "type": "object", "properties": { "maxRetries": { "type": "number", "description": "Maximum number of retries for failed requests.", "visibility": "frontend" }, "retryStatusCodes": { "type": "array", "items": { "type": "number" }, "description": "HTTP status codes that should trigger a retry.", "visibility": "frontend" }, "maxApiRequestsPerMinute": { "type": "number", "description": "Maximum number of API requests allowed per minute. Set to -1 to disable rate limiting.", "visibility": "frontend" } }, "description": "Retry configuration for requests.", "visibility": "frontend" } }, "required": [ "host" ] }, "description": "Integration configuration for GitLab" }, "googleGcs": { "type": "object", "properties": { "clientEmail": { "type": "string", "description": "Service account email used to authenticate requests." }, "privateKey": { "type": "string", "description": "Service account private key used to authenticate requests.", "visibility": "secret" } }, "description": "Integration configuration for Google Cloud Storage" }, "awsS3": { "type": "array", "items": { "type": "object", "properties": { "endpoint": { "type": "string", "description": "AWS Endpoint. The endpoint URI to send requests to. The default endpoint is built from the configured region.", "visibility": "frontend" }, "s3ForcePathStyle": { "type": "boolean", "description": "Whether to use path style URLs when communicating with S3. Defaults to false. This allows providers like LocalStack, Minio and Wasabi (and possibly others) to be used.", "visibility": "frontend" }, "accessKeyId": { "type": "string", "description": "Account access key used to authenticate requests." }, "secretAccessKey": { "type": "string", "description": "Account secret key used to authenticate requests.", "visibility": "secret" }, "roleArn": { "type": "string", "description": "ARN of the role to be assumed" }, "externalId": { "type": "string", "description": "External ID to use when assuming role" } } }, "description": "Integration configuration for AWS S3 Service" }, "gitea": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The hostname of the given Gitea instance", "visibility": "frontend" }, "baseUrl": { "type": "string", "description": "The base url for the Gitea instance.", "visibility": "frontend" }, "username": { "type": "string", "description": "The username to use for authenticated requests.", "visibility": "secret" }, "password": { "type": "string", "description": "Gitea password used to authenticate requests. This can be either a password or a generated access token.", "visibility": "secret" }, "commitSigningKey": { "type": "string", "description": "PGP signing key for signing commits.", "visibility": "secret" } }, "required": [ "host" ] }, "description": "Integration configuration for Gitea" }, "harness": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "The hostname of the given Harness Code instance", "visibility": "frontend" }, "apiKey": { "type": "string", "description": "The apikey to use for authenticated requests.", "visibility": "secret" }, "token": { "type": "string", "description": "Harness Code token used to authenticate requests. This can be either a generated access token.", "visibility": "secret" } }, "required": [ "host" ] }, "description": "Integration configuration for Harness Code" } }, "description": "Configuration for integrations towards various external repository provider systems", "visibility": "frontend" } } }, "packageName": "@backstage/integration" }, { "path": "../../plugins/catalog/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "catalog": { "type": "object", "properties": { "experimentalPagination": { "anyOf": [ { "type": "boolean" }, { "type": "object", "properties": { "limit": { "type": "number" } } } ], "deepVisibility": "frontend" } } } } }, "packageName": "@backstage/plugin-catalog" }, { "path": "../frontend-app-api/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "app": { "type": "object", "properties": { "packages": { "anyOf": [ { "type": "string", "const": "all" }, { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } } } ], "description": "Controls what packages are loaded by the new frontend system.", "visibility": "frontend", "deepVisibility": "frontend" }, "routes": { "type": "object", "properties": { "bindings": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "boolean", "const": false } ] }, "description": "Maps external route references to regular route references. Both the key and the value is expected to be on the form `.`. If the value is `false`, the route will be disabled even if it has a default mapping.", "deepVisibility": "frontend" } } }, "extensions": { "type": "array", "items": { "anyOf": [ { "type": "string" }, { "type": "object", "additionalProperties": { "anyOf": [ { "type": "boolean" }, { "type": "object", "properties": { "attachTo": { "type": "object", "properties": { "id": { "type": "string" }, "input": { "type": "string" } }, "required": [ "id", "input" ] }, "disabled": { "type": "boolean" }, "config": {} } } ] } } ] }, "deepVisibility": "frontend" }, "pluginOverrides": { "type": "array", "items": { "type": "object", "properties": { "match": { "type": "object", "properties": { "pluginId": { "type": "string", "description": "A pattern that is matched against the plugin ID." }, "packageName": { "type": "string", "description": "A pattern that is matched against the package name." } }, "description": "The criteria for matching plugins to override." }, "info": { "type": "object", "properties": { "description": { "type": "string", "description": "Override the description of the plugin." }, "ownerEntityRefs": { "type": "array", "items": { "type": "string" }, "description": "Override the owner entity references of the plugin." }, "links": { "type": "array", "items": { "type": "object", "properties": { "title": { "type": "string" }, "url": { "type": "string" } }, "required": [ "title", "url" ] }, "description": "Override the links of the plugin." } }, "description": "Overrides individual top-level fields of the plugin info." } }, "required": [ "info" ] }, "description": "This section enables you to override certain properties of specific or groups of plugins.", "deepVisibility": "frontend" } } } } }, "packageName": "@backstage/frontend-app-api" }, { "path": "../backend-plugin-api/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "backend": { "type": "object", "properties": { "workingDirectory": { "type": "string", "description": "An absolute path to a directory that can be used as a working dir, for example as scratch space for large operations." } } } } }, "packageName": "@backstage/backend-plugin-api" }, { "path": "../../plugins/auth-backend/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "auth": { "type": "object", "properties": { "environment": { "type": "string", "description": "The 'environment' attribute", "visibility": "frontend" }, "session": { "type": "object", "properties": { "secret": { "type": "string", "description": "The secret attribute of session object.", "visibility": "secret" } } }, "identityTokenAlgorithm": { "type": "string", "description": "JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256. Must match one of the algorithms defined for IdentityClient. When setting a different algorithm, check if the `key` field of the `signing_keys` table can fit the length of the generated keys. If not, add a knex migration file in the migrations folder. More info on supported algorithms: https://github.com/panva/jose" }, "omitIdentityTokenOwnershipClaim": { "type": "boolean", "description": "Whether to omit the entity ownership references (`ent`) claim from the identity token.\n\nIf this is disabled an `ent` claim will be included in the token containing all of the user's ownership refs as returned by the sign in resolver. This can in extreme cases lead to tokens that risk hitting HTTP header size limits. Setting it to `false` is therefore discouraged, and is only provided for backward compatibility reasons.\n\nDefaults to `true`, which means that the `ent` claim instead is available via the user info endpoint and the `UserInfoService`." }, "keyStore": { "type": "object", "properties": { "provider": { "type": "string", "enum": [ "database", "memory", "firestore", "static" ] }, "firestore": { "type": "object", "properties": { "host": { "type": "string", "description": "The host to connect to" }, "port": { "type": "number", "description": "The port to connect to" }, "ssl": { "type": "boolean", "description": "Whether to use SSL when connecting." }, "projectId": { "type": "string", "description": "The Google Cloud Project ID" }, "keyFilename": { "type": "string", "description": "Local file containing the Service Account credentials. You can omit this value to automatically read from GOOGLE_APPLICATION_CREDENTIALS env which is useful for local development." }, "path": { "type": "string", "description": "The path to use for the collection. Defaults to 'sessions'" }, "timeout": { "type": "number", "description": "Timeout used for database operations. Defaults to 10000ms" } } }, "static": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "publicKeyFile": { "type": "string", "description": "Path to the public key file in the SPKI format" }, "privateKeyFile": { "type": "string", "description": "Path to the matching private key file in the PKCS#8 format" }, "keyId": { "type": "string", "description": "id to uniquely identify this key within the JWK set" }, "algorithm": { "type": "string", "description": "JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256. Must match the algorithm used to generate the keys in the provided files" } }, "required": [ "publicKeyFile", "privateKeyFile", "keyId" ] }, "description": "Must be declared at least once and the first one will be used for signing" } }, "required": [ "keys" ] } }, "description": "To control how to store JWK data in auth-backend" }, "backstageTokenExpiration": { "anyOf": [ { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "The backstage token expiration." }, "experimentalRefreshToken": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable refresh tokens", "default": false, "visibility": "backend" }, "tokenLifetime": { "anyOf": [ { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "Token lifetime before rotation required", "default": "30 days", "visibility": "backend" }, "maxRotationLifetime": { "anyOf": [ { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "Maximum session lifetime across all rotations", "default": "1 year", "visibility": "backend" }, "maxTokensPerUser": { "type": "number", "description": "Maximum number of refresh tokens per user", "default": 20, "visibility": "backend" }, "dangerouslyDisableCatalogPresenceCheck": { "type": "boolean", "description": "Disables the check that verifies the user's catalog entity still exists when refreshing a token. This is an escape hatch for Backstage instances that allow sign-in without a corresponding catalog user entity. Without the check, refresh tokens for removed or offboarded users remain valid until they naturally expire.", "default": false, "visibility": "backend" } }, "description": "Configuration for refresh tokens (offline access)", "visibility": "backend" }, "experimentalExtraAllowedOrigins": { "type": "array", "items": { "type": "string" }, "description": "Additional app origins to allow for authenticating" }, "experimentalDynamicClientRegistration": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable dynamic client registration Defaults to false" }, "allowedRedirectUriPatterns": { "type": "array", "items": { "type": "string" }, "description": "A list of allowed URI patterns to use for redirect URIs during dynamic client registration.\n\nPatterns are matched per URL component: a `*` in the hostname or path only matches within that component, and a `:*` port matches any port. Patterns must include an explicit protocol and only match the path they list, e.g. `http://localhost:*\\/*` allows any port and any path on localhost.\n\nDefaults to Cursor and loopback addresses (localhost, 127.0.0.1, [::1]).", "examples": [ [ "http://localhost:*/*", "https://*.example.com/callback" ] ] } }, "description": "Configuration for dynamic client registration", "deprecated": "Use `auth.clientIdMetadataDocuments` instead." }, "clientIdMetadataDocuments": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable Client ID Metadata Documents support Defaults to false" }, "allowedClientIdPatterns": { "type": "array", "items": { "type": "string" }, "description": "A list of allowed URI patterns for client_id URLs. Uses glob-style pattern matching where `*` matches any characters. Defaults to `['https://claude.ai/*', 'https://vscode.dev/*', '{baseUrl}/.well-known/oauth-client/cli.json']` where `{baseUrl}` is the auth backend's base URL.", "examples": [ [ "https://example.com/*", "https://*.trusted-domain.com/*" ] ] }, "allowedRedirectUriPatterns": { "type": "array", "items": { "type": "string" }, "description": "A list of allowed URI patterns for redirect URIs. Uses glob-style pattern matching where `*` matches any characters. Defaults to loopback addresses (localhost, 127.0.0.1, [::1]).", "examples": [ [ "http://localhost:*", "http://127.0.0.1:*/callback" ] ] } }, "description": "Configuration for Client ID Metadata Documents (CIMD)" }, "experimentalClientIdMetadataDocuments": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable Client ID Metadata Documents support Defaults to false" }, "allowedClientIdPatterns": { "type": "array", "items": { "type": "string" }, "description": "A list of allowed URI patterns for client_id URLs.\n\nPatterns are matched per URL component: a `*` in the hostname or path only matches within that component, and a `:*` port matches any port. Patterns must include an explicit protocol.\n\nDefaults to `['https://claude.ai/*', 'https://vscode.dev/*', '{baseUrl}/.well-known/oauth-client/cli.json']` where `{baseUrl}` is the auth backend's base URL.", "examples": [ [ "https://example.com/*", "https://*.trusted-domain.com/*" ] ] }, "allowedRedirectUriPatterns": { "type": "array", "items": { "type": "string" }, "description": "A list of allowed URI patterns for redirect URIs.\n\nPatterns are matched per URL component: a `*` in the hostname or path only matches within that component, and a `:*` port matches any port. Patterns must include an explicit protocol and only match the path they list, e.g. `http://localhost:*\\/*` allows any port and any path on localhost.\n\nDefaults to loopback addresses (localhost, 127.0.0.1, [::1]).", "examples": [ [ "http://localhost:*/*", "http://127.0.0.1:*/callback" ] ] } }, "description": "Configuration for Client ID Metadata Documents (CIMD)", "deprecated": "This is no longer experimental; use `auth.clientIdMetadataDocuments` instead." } }, "description": "Configuration options for the auth plugin" } } }, "packageName": "@backstage/plugin-auth-backend" }, { "path": "../../plugins/auth-backend-module-guest-provider/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "auth": { "type": "object", "properties": { "providers": { "type": "object", "properties": { "guest": { "type": "object", "properties": { "userEntityRef": { "type": "string", "description": "The entity reference to use for the guest user.", "default": "user:development/guest" }, "ownershipEntityRefs": { "type": "array", "items": { "type": "string" }, "description": "A list of entity references to user for ownership of the guest user if the user is not found in the catalog.", "default": "[userEntityRef]" }, "dangerouslyAllowOutsideDevelopment": { "type": "boolean", "description": "Allow users to sign in with the guest provider outside of their development environments." } } } } } }, "required": [ "providers" ], "description": "Configuration options for the auth plugin" } } }, "packageName": "@backstage/plugin-auth-backend-module-guest-provider" }, { "path": "../backend-app-api/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "backend": { "type": "object", "properties": { "packages": { "anyOf": [ { "type": "string", "const": "all" }, { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } } } ], "description": "Used by the feature discovery service" }, "startup": { "type": "object", "properties": { "default": { "type": "object", "properties": { "onPluginBootFailure": { "type": "string", "enum": [ "continue", "abort" ], "description": "The default value for `onPluginBootFailure` if not specified for a particular plugin. This defaults to 'abort', which means `onPluginBootFailure: continue` must be specified for backend startup to continue on plugin boot failure. This can also be set to 'continue', which flips the logic for individual plugins so that they must be set to `onPluginBootFailure: abort` to be required." }, "onPluginModuleBootFailure": { "type": "string", "enum": [ "continue", "abort" ], "description": "The default value for `onPluginModuleBootFailure` if not specified for a particular plugin module. This defaults to 'abort', which means `onPluginModuleBootFailure: continue` must be specified for backend startup to continue on plugin module boot failure. This can also be set to 'continue', which flips the logic for individual plugin modules so that they must be set to `onPluginModuleBootFailure: abort` to be required." } } }, "plugins": { "type": "object", "additionalProperties": { "type": "object", "properties": { "onPluginBootFailure": { "type": "string", "enum": [ "continue", "abort" ], "description": "Used to control backend startup behavior when this plugin fails to boot up. Setting this to `continue` allows the backend to continue starting up, even if this plugin fails. This can enable leaving a crashing plugin installed, but still permit backend startup, which may help troubleshoot data-dependent issues. Plugin failures for plugins set to `abort` are fatal (this is the default unless overridden by the `default` setting)." }, "modules": { "type": "object", "additionalProperties": { "type": "object", "properties": { "onPluginModuleBootFailure": { "type": "string", "enum": [ "continue", "abort" ], "description": "Used to control backend startup behavior when this plugin module fails to boot up. Setting this to `continue` allows the backend to continue starting up, even if this plugin module fails. This can enable leaving a crashing plugin installed, but still permit backend startup, which may help troubleshoot data-dependent issues. Plugin module failures for plugin modules set to `abort` are fatal (this is the default unless overridden by the `default` setting)." } } } } } } } } } } } } }, "packageName": "@backstage/backend-app-api" }, { "path": "../backend-defaults/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "app": { "type": "object", "properties": { "baseUrl": { "type": "string" } }, "required": [ "baseUrl" ] }, "backend": { "type": "object", "properties": { "baseUrl": { "type": "string", "description": "The full base URL of the backend, as seen from the browser's point of view as it makes calls to the backend." }, "lifecycle": { "type": "object", "properties": { "startupRequestPauseTimeout": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "The maximum time that paused requests will wait for the service to start, before returning an error. Defaults to 5 seconds Supported formats:\n- A string in the format of '1d', '2 seconds' etc. as supported by the `ms` library.\n- A standard ISO formatted duration string, e.g. 'P2DT6H' or 'PT1M'.\n- An object with individual units (in plural) as keys, e.g. `{ days: 2, hours: 6 }`." }, "serverShutdownDelay": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "The minimum time that the HTTP server will delay the shutdown of the backend. During this delay health checks will be set to failing, allowing traffic to drain. Defaults to 0 seconds. Supported formats:\n- A string in the format of '1d', '2 seconds' etc. as supported by the `ms` library.\n- A standard ISO formatted duration string, e.g. 'P2DT6H' or 'PT1M'.\n- An object with individual units (in plural) as keys, e.g. `{ days: 2, hours: 6 }`." } } }, "trustProxy": { "anyOf": [ { "type": "boolean" }, { "type": "number" }, { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Corresponds to the Express `trust proxy` setting." }, "listen": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "host": { "type": "string", "description": "Address of the interface that the backend should bind to." }, "port": { "type": [ "string", "number" ], "description": "Port that the backend should listen to." } } } ], "description": "Address that the backend should listen to." }, "https": { "anyOf": [ { "type": "boolean", "const": true }, { "type": "object", "properties": { "certificate": { "type": "object", "properties": { "cert": { "type": "string", "description": "PEM encoded certificate. Use $file to load in a file" }, "key": { "type": "string", "description": "PEM encoded certificate key. Use $file to load in a file.", "visibility": "secret" } }, "required": [ "cert", "key" ], "description": "Certificate configuration" } } } ], "description": "HTTPS configuration for the backend. If omitted the backend will serve HTTP.\n\nSetting this to `true` will cause self-signed certificates to be generated, which can be useful for local development or other non-production scenarios." }, "server": { "type": "object", "properties": { "headersTimeout": { "anyOf": [ { "type": "number" }, { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "Sets the timeout value for receiving the complete HTTP headers from the client." }, "requestTimeout": { "anyOf": [ { "type": "number" }, { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "Sets the timeout value for receiving the entire request (headers and body) from the client." }, "keepAliveTimeout": { "anyOf": [ { "type": "number" }, { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "Sets the timeout value for inactivity on a socket during keep-alive." }, "timeout": { "anyOf": [ { "type": "number" }, { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "Sets the timeout value for sockets." }, "maxHeadersCount": { "type": "number", "description": "Limits maximum incoming headers count." }, "maxRequestsPerSocket": { "type": "number", "description": "Sets the maximum number of requests socket can handle before closing keep alive connection." } }, "description": "Server-level HTTP options configuration for the backend. These options are passed directly to the underlying Node.js HTTP server.\n\nTimeout values support multiple formats:\n- A number in milliseconds\n- A string in the format of '1d', '2 seconds' etc. as supported by the `ms` library\n- A standard ISO formatted duration string, e.g. 'P2DT6H' or 'PT1M'\n- An object with individual units (in plural) as keys, e.g. `{ days: 2, hours: 6 }`" }, "auditor": { "type": "object", "properties": { "severityLogLevelMappings": { "type": "object", "properties": { "low": { "type": "string", "enum": [ "debug", "info", "warn", "error" ] }, "medium": { "type": "string", "enum": [ "debug", "info", "warn", "error" ] }, "high": { "type": "string", "enum": [ "debug", "info", "warn", "error" ] }, "critical": { "type": "string", "enum": [ "debug", "info", "warn", "error" ] } }, "description": "Defines how audit event severity levels are mapped to log levels. This allows you to control the verbosity of audit logs based on the severity of the event. For example, you might want to log 'low' severity events as 'debug' messages, while logging 'critical' events as 'error' messages. Each severity level ('low', 'medium', 'high', 'critical') can be mapped to one of the standard log levels ('debug', 'info', 'warn', 'error').\n\nBy default, audit events are mapped to log levels as follows:\n- `low`: `debug`\n- `medium`: `info`\n- `high`: `info`\n- `critical`: `info`" } }, "description": "Options used by the default auditor service." }, "actions": { "type": "object", "properties": { "pluginSources": { "type": "array", "items": { "type": "string" }, "description": "List of plugin sources to load actions from." }, "filter": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Glob pattern for action IDs to match. Action IDs have the format `{pluginId}:{actionName}`.", "examples": [ "catalog:*" ] }, "attributes": { "type": "object", "properties": { "destructive": { "type": "boolean", "description": "If specified, only match actions where destructive matches this value. Actions default to destructive: true if not explicitly set." }, "readOnly": { "type": "boolean", "description": "If specified, only match actions where readOnly matches this value. Actions default to readOnly: false if not explicitly set." }, "idempotent": { "type": "boolean", "description": "If specified, only match actions where idempotent matches this value. Actions default to idempotent: false if not explicitly set." } }, "description": "Attribute constraints. All specified attributes must match. Actions are compared against their resolved attributes (with defaults applied)." } } }, "description": "Rules for actions to include. An action must match at least one rule to be included. Each rule can specify an id pattern and/or attribute constraints. If no include rules are specified, all actions are included by default." }, "exclude": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Glob pattern for action IDs to match. Action IDs have the format `{pluginId}:{actionName}`.", "examples": [ "*:delete-*" ] }, "attributes": { "type": "object", "properties": { "destructive": { "type": "boolean", "description": "If specified, only match actions where destructive matches this value. Actions default to destructive: true if not explicitly set." }, "readOnly": { "type": "boolean", "description": "If specified, only match actions where readOnly matches this value. Actions default to readOnly: false if not explicitly set." }, "idempotent": { "type": "boolean", "description": "If specified, only match actions where idempotent matches this value. Actions default to idempotent: false if not explicitly set." } }, "description": "Attribute constraints. All specified attributes must match. Actions are compared against their resolved attributes (with defaults applied)." } } }, "description": "Rules for actions to exclude. Exclusions take precedence over inclusions. Each rule can specify an id pattern and/or attribute constraints." } }, "description": "Filter configuration for actions. Allows controlling which actions are exposed to consumers based on patterns and attributes." } }, "description": "Options used by the default actions service." }, "auth": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "secret": { "type": "string", "description": "Secret for generating tokens. Should be a base64 string, recommended length is 24 bytes.", "visibility": "secret" } }, "required": [ "secret" ] }, "description": "Keys shared by all backends for signing and validating backend tokens.", "deprecated": "this will be removed when the backwards compatibility is no longer needed with backend-common" }, "dangerouslyDisableDefaultAuthPolicy": { "type": "boolean", "description": "This disables the otherwise default auth policy, which requires all requests to be authenticated with either user or service credentials.\n\nDisabling this check means that the backend will no longer block unauthenticated requests, but instead allow them to pass through to plugins.\n\nIf permissions are enabled, unauthenticated requests will be treated exactly as such, leaving it to the permission policy to determine what permissions should be allowed for an unauthenticated identity. Note that this will also apply to service-to-service calls between plugins unless you configure credentials for service calls." }, "pluginKeyStore": { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "database" } }, "required": [ "type" ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "static" }, "static": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "publicKeyFile": { "type": "string", "description": "Path to the public key file in the SPKI format. Should be an absolute path." }, "privateKeyFile": { "type": "string", "description": "Path to the matching private key file in the PKCS#8 format. Should be an absolute path.\n\nThe first array entry must specify a private key file, the rest must not." }, "keyId": { "type": "string", "description": "ID to uniquely identify this key within the JWK set." }, "algorithm": { "type": "string", "description": "JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256. Must match the algorithm used to generate the keys in the provided files" } }, "required": [ "publicKeyFile", "keyId" ] }, "description": "Must be declared at least once and the first one will be used for signing." } }, "required": [ "keys" ] } }, "required": [ "type", "static" ] } ], "description": "Controls how to store keys for plugin-to-plugin auth" }, "externalAccess": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "legacy", "description": "This is the legacy service-to-service access method, where a set of static keys were shared among plugins and used for symmetric signing and verification. These correspond to the old `backend.auth.keys` set and retain their behavior for backwards compatibility. Please migrate to other access methods when possible.\n\nCallers generate JWT tokens with the following payload:\n\n```json { \"sub\": \"backstage-plugin\", \"exp\": } ```\n\nAnd sign them with HS256, using the base64 decoded secret. The tokens are then passed along with requests in the Authorization header:\n\n``` Authorization: Bearer eyJhbGciOiJIUzI... ```" }, "options": { "type": "object", "properties": { "secret": { "type": "string", "description": "Any set of base64 encoded random bytes to be used as both the signing and verification key. Should be sufficiently long so as not to be easy to guess by brute force.\n\nCan be generated eg using\n\n```sh node -p 'require(\"crypto\").randomBytes(24).toString(\"base64\")' ```", "visibility": "secret" }, "subject": { "type": "string", "description": "Sets the subject of the principal, when matching this token. Useful for debugging and tracking purposes." } }, "required": [ "secret", "subject" ] }, "accessRestrictions": { "type": "array", "items": { "type": "object", "properties": { "plugin": { "type": "string", "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below." }, "permission": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "If given, this method is limited to only performing actions with these named permissions in this plugin.\n\nNote that this only applies where permissions checks are enabled in the first place. Endpoints that are not protected by the permissions system at all, are not affected by this setting." }, "permissionAttribute": { "type": "object", "properties": { "action": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "One of more of 'create', 'read', 'update', or 'delete'." } }, "description": "If given, this method is limited to only performing actions whose permissions have these attributes.\n\nNote that this only applies where permissions checks are enabled in the first place. Endpoints that are not protected by the permissions system at all, are not affected by this setting." } }, "required": [ "plugin" ] }, "description": "Restricts what types of access that are permitted for this access method. If no access restrictions are given, it'll have unlimited access. This access restriction applies for the framework level; individual plugins may have their own access control mechanisms on top of this." } }, "required": [ "type", "options" ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "static", "description": "This access method consists of random static tokens that can be handed out to callers.\n\nThe tokens are then passed along verbatim with requests in the Authorization header:\n\n``` Authorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW ```" }, "options": { "type": "object", "properties": { "token": { "type": "string", "description": "A raw token that can be any string, but for security reasons should be sufficiently long so as not to be easy to guess by brute force.\n\nCan be generated eg using\n\n```sh node -p 'require(\"crypto\").randomBytes(24).toString(\"base64\")' ```\n\nSince the tokens can be any string, you are free to add additional identifying data to them if you like. For example, adding a `freben-local-dev-` prefix for debugging purposes to a token that you know will be handed out for use as a personal access token during development.", "visibility": "secret" }, "subject": { "type": "string", "description": "Sets the subject of the principal, when matching this token. Useful for debugging and tracking purposes." } }, "required": [ "token", "subject" ] }, "accessRestrictions": { "type": "array", "items": { "type": "object", "properties": { "plugin": { "type": "string", "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below." }, "permission": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "If given, this method is limited to only performing actions with these named permissions in this plugin.\n\nNote that this only applies where permissions checks are enabled in the first place. Endpoints that are not protected by the permissions system at all, are not affected by this setting." }, "permissionAttribute": { "type": "object", "properties": { "action": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "One of more of 'create', 'read', 'update', or 'delete'." } }, "description": "If given, this method is limited to only performing actions whose permissions have these attributes.\n\nNote that this only applies where permissions checks are enabled in the first place. Endpoints that are not protected by the permissions system at all, are not affected by this setting." } }, "required": [ "plugin" ] }, "description": "Restricts what types of access that are permitted for this access method. If no access restrictions are given, it'll have unlimited access. This access restriction applies for the framework level; individual plugins may have their own access control mechanisms on top of this." } }, "required": [ "type", "options" ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "jwks", "description": "This access method consists of a JWKS endpoint that can be used to verify JWT tokens.\n\nCallers generate JWT tokens via 3rd party tooling and pass them in the Authorization header:\n\n``` Authorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW ```" }, "options": { "type": "object", "properties": { "url": { "type": "string", "description": "The full URL of the JWKS endpoint." }, "algorithm": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Sets the algorithm(s) that should be used to verify the JWT tokens. The passed JWTs must have been signed using one of the listed algorithms." }, "issuer": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Sets the issuer(s) that should be used to verify the JWT tokens. Passed JWTs must have an `iss` claim which matches one of the specified issuers." }, "audience": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Sets the audience(s) that should be used to verify the JWT tokens. The passed JWTs must have an \"aud\" claim that matches one of the audiences specified, or have no audience specified." }, "subjectPrefix": { "type": "string", "description": "Sets an optional subject prefix. Passes the subject to called plugins. Useful for debugging and tracking purposes." } }, "required": [ "url" ] }, "accessRestrictions": { "type": "array", "items": { "type": "object", "properties": { "plugin": { "type": "string", "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below." }, "permission": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "If given, this method is limited to only performing actions with these named permissions in this plugin.\n\nNote that this only applies where permissions checks are enabled in the first place. Endpoints that are not protected by the permissions system at all, are not affected by this setting." }, "permissionAttribute": { "type": "object", "properties": { "action": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "One of more of 'create', 'read', 'update', or 'delete'." } }, "description": "If given, this method is limited to only performing actions whose permissions have these attributes.\n\nNote that this only applies where permissions checks are enabled in the first place. Endpoints that are not protected by the permissions system at all, are not affected by this setting." } }, "required": [ "plugin" ] }, "description": "Restricts what types of access that are permitted for this access method. If no access restrictions are given, it'll have unlimited access. This access restriction applies for the framework level; individual plugins may have their own access control mechanisms on top of this." } }, "required": [ "type", "options" ] } ] }, "description": "Configures methods of external access, ie ways for callers outside of the Backstage ecosystem to get authorized for access to APIs that do not permit unauthorized access." } }, "description": "Options used by the default auth, httpAuth and userInfo services." }, "database": { "type": "object", "properties": { "client": { "type": "string", "enum": [ "better-sqlite3", "sqlite3", "pg", "embedded-postgres" ], "description": "Default database client to use" }, "connection": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "azure", "description": "The specific config for Azure database for PostgreSQL connections with Entra authentication" }, "tokenCredential": { "type": "object", "properties": { "tokenRenewableOffsetTime": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "How early before an access token expires to refresh it with a new one. Defaults to 5 minutes Supported formats:\n- A string in the format of '1d', '2 seconds' etc. as supported by the `ms` library.\n- A standard ISO formatted duration string, e.g. 'P2DT6H' or 'PT1M'.\n- An object with individual units (in plural) as keys, e.g. `{ days: 2, hours: 6 }`." }, "clientId": { "type": "string" }, "clientSecret": { "type": "string", "visibility": "secret" }, "tenantId": { "type": "string" } }, "description": "Optional Azure token credential configuration" } }, "required": [ "type" ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "cloudsql", "description": "The specific config for cloudsql connections" }, "instance": { "type": "string", "description": "The instance connection name for the cloudsql instance, e.g. `project:region:instance`" }, "ipAddressType": { "type": "string", "enum": [ "PUBLIC", "PRIVATE", "PSC" ], "description": "The ip address type to use for the connection. Defaults to 'PUBLIC'" } }, "required": [ "type", "instance" ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "rds", "description": "The specific config for AWS RDS connections with IAM authentication. Requires the `@aws-sdk/rds-signer` package to be installed. The IAM role or user must have the `rds-db:connect` permission for the database user." }, "host": { "type": "string", "description": "The hostname of the RDS instance." }, "port": { "type": "number", "description": "The port number the database is listening on." }, "user": { "type": "string", "description": "The database user to authenticate as. This user must have the `rds_iam` role granted." }, "region": { "type": "string", "description": "The AWS region where the RDS instance is located. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables if not set." } }, "required": [ "type", "host", "port", "user" ], "additionalProperties": { "description": "Other connection settings" } }, { "type": "object", "properties": { "type": { "type": "string", "const": "default", "description": "The rest config for default, regular connections" }, "password": { "type": "string", "description": "Password that belongs to the client User", "visibility": "secret" } }, "additionalProperties": { "description": "Other connection settings" } } ], "description": "Base database connection string, or object with individual connection properties", "visibility": "secret" }, "prefix": { "type": "string", "description": "Database name prefix override" }, "ensureExists": { "type": "boolean", "description": "Whether to ensure the given database exists by creating it if it does not. Defaults to true if unspecified." }, "ensureSchemaExists": { "type": "boolean", "description": "Whether to ensure the given database schema exists by creating it if it does not. Defaults to false if unspecified.\n\nNOTE: Currently only supported by the `pg` client when pluginDivisionMode: schema" }, "pluginDivisionMode": { "type": "string", "enum": [ "database", "schema" ], "description": "How plugins databases are managed/divided in the provided database instance.\n\n`database` -> Plugins are each given their own database to manage their schemas/tables.\n\n`schema` -> Plugins will be given their own schema (in the specified/default database) to manage their tables.\n\nNOTE: Currently only supported by the `pg` client.", "default": "database" }, "role": { "type": "string", "description": "Configures the ownership of newly created schemas in pg databases." }, "knexConfig": { "type": "object", "description": "Arbitrary config object to pass to knex when initializing (https://knexjs.org/#Installation-client). Most notable is the debug and asyncStackTraces booleans" }, "skipMigrations": { "type": "boolean", "description": "Skip running database migrations." }, "plugin": { "type": "object", "additionalProperties": { "type": "object", "properties": { "client": { "type": "string", "enum": [ "better-sqlite3", "sqlite3", "pg" ], "description": "Database client override" }, "connection": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "cloudsql", "description": "The specific config for cloudsql connections" }, "instance": { "type": "string", "description": "The instance connection name for the cloudsql instance, e.g. `project:region:instance`" } }, "required": [ "type", "instance" ] }, { "type": "object", "properties": { "password": { "type": "string", "description": "Password that belongs to the client User", "visibility": "secret" } }, "additionalProperties": { "description": "Other connection settings" } } ], "description": "Database connection string or Knex object override", "visibility": "secret" }, "ensureExists": { "type": "boolean", "description": "Whether to ensure the given database exists by creating it if it does not. Defaults to base config if unspecified." }, "ensureSchemaExists": { "type": "boolean", "description": "Whether to ensure the given database schema exists by creating it if it does not. Defaults to false if unspecified.\n\nNOTE: Currently only supported by the `pg` client when pluginDivisionMode: schema" }, "knexConfig": { "type": "object", "description": "Arbitrary config object to pass to knex when initializing (https://knexjs.org/#Installation-client). Most notable is the debug and asyncStackTraces booleans.\n\nThis is merged recursively into the base knexConfig" }, "role": { "type": "string", "description": "Configures the ownership of newly created schemas in pg databases." }, "skipMigrations": { "type": "boolean", "description": "Skip running database migrations." } } }, "description": "Plugin specific database configuration and client override" } }, "required": [ "client", "connection" ], "description": "Database connection configuration, select base database type using the `client` field" }, "cache": { "anyOf": [ { "type": "object", "properties": { "store": { "type": "string", "const": "memory" }, "defaultTtl": { "anyOf": [ { "type": "number" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "An optional default TTL (in milliseconds, if given as a number)." } }, "required": [ "store" ] }, { "type": "object", "properties": { "store": { "type": "string", "const": "redis" }, "connection": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "url": { "type": "string", "description": "The Redis connection URL." } }, "required": [ "url" ], "additionalProperties": { "description": "Other connection settings" } } ], "description": "A redis connection string in the form `redis://user:pass@host:port`, or an object with connection options passed directly to the underlying client (e.g. `{ url: 'redis://localhost:6379', pingInterval: 60000 }`). The object form is only supported for the Redis store.", "visibility": "secret" }, "defaultTtl": { "anyOf": [ { "type": "number" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "An optional default TTL (in milliseconds, if given as a number)." }, "redis": { "type": "object", "properties": { "client": { "type": "object", "properties": { "namespace": { "type": "string", "description": "Namespace for the current instance." }, "keyPrefixSeparator": { "type": "string", "description": "Separator to use between namespace and key." }, "clearBatchSize": { "type": "number", "description": "Number of keys to delete in a single batch." }, "useUnlink": { "type": "boolean", "description": "Enable Unlink instead of using Del for clearing keys. This is more performant but may not be supported by all Redis versions." }, "noNamespaceAffectsAll": { "type": "boolean", "description": "Whether to allow clearing all keys when no namespace is set. If set to true and no namespace is set, iterate() will return all keys. Defaults to `false`." } }, "description": "An optional Redis client configuration. These options are passed to the `@keyv/redis` client." }, "cluster": { "type": "object", "properties": { "rootNodes": { "type": "array", "items": { "type": "object" }, "description": "Cluster configuration options to be passed to the `@keyv/redis` client (and node-redis under the hood) https://github.com/redis/node-redis/blob/master/docs/clustering.md", "visibility": "secret" }, "defaults": { "type": "object", "description": "Cluster node default configuration options to be passed to the `@keyv/redis` client (and node-redis under the hood) https://github.com/redis/node-redis/blob/master/docs/clustering.md", "visibility": "secret" }, "minimizeConnections": { "type": "boolean", "description": "When `true`, `.connect()` will only discover the cluster topology, without actually connecting to all the nodes. Useful for short-term or PubSub-only connections." }, "useReplicas": { "type": "boolean", "description": "When `true`, distribute load by executing readonly commands (such as `GET`, `GEOSEARCH`, etc.) across all cluster nodes. When `false`, only use master nodes." }, "maxCommandRedirections": { "type": "number", "description": "The maximum number of times a command will be redirected due to `MOVED` or `ASK` errors." } }, "required": [ "rootNodes" ], "description": "An optional Redis cluster configuration." } } } }, "required": [ "store", "connection" ] }, { "type": "object", "properties": { "store": { "type": "string", "const": "valkey" }, "connection": { "type": "string", "description": "A valkey connection string in the form `redis://user:pass@host:port`.", "visibility": "secret" }, "defaultTtl": { "anyOf": [ { "type": "number" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "An optional default TTL (in milliseconds, if given as a number)." }, "valkey": { "type": "object", "properties": { "client": { "type": "object", "properties": { "keyPrefix": { "type": "string", "description": "Namespace and separator used for prefixing keys." } }, "description": "An optional Valkey client configuration. These options are passed to the `@keyv/valkey` client." }, "cluster": { "type": "object", "properties": { "rootNodes": { "type": "array", "items": { "type": "object" }, "description": "Cluster configuration options to be passed to the `@keyv/valkey` client (and node-redis under the hood) https://github.com/redis/node-redis/blob/master/docs/clustering.md", "visibility": "secret" }, "defaults": { "type": "object", "description": "Cluster node default configuration options to be passed to the `@keyv/redis` client (and node-redis under the hood) https://github.com/redis/node-redis/blob/master/docs/clustering.md", "visibility": "secret" }, "minimizeConnections": { "type": "boolean", "description": "When `true`, `.connect()` will only discover the cluster topology, without actually connecting to all the nodes. Useful for short-term or PubSub-only connections." }, "useReplicas": { "type": "boolean", "description": "When `true`, distribute load by executing readonly commands (such as `GET`, `GEOSEARCH`, etc.) across all cluster nodes. When `false`, only use master nodes." }, "maxCommandRedirections": { "type": "number", "description": "The maximum number of times a command will be redirected due to `MOVED` or `ASK` errors." } }, "required": [ "rootNodes" ], "description": "An optional Valkey cluster (redis cluster under the hood) configuration." } } } }, "required": [ "store", "connection" ] }, { "type": "object", "properties": { "store": { "type": "string", "const": "memcache" }, "connection": { "type": "string", "description": "A memcache connection string in the form `user:pass@host:port`.", "visibility": "secret" }, "defaultTtl": { "anyOf": [ { "type": "number" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "An optional default TTL (in milliseconds)." } }, "required": [ "store", "connection" ] }, { "type": "object", "properties": { "store": { "type": "string", "const": "infinispan", "description": "Infinispan cache store configuration." }, "defaultTtl": { "anyOf": [ { "type": "number" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ], "description": "An optional default TTL (in milliseconds)." }, "infinispan": { "type": "object", "properties": { "version": { "type": "string", "enum": [ "2.9", "2.5", "2.2" ], "description": "Version of client/server protocol.", "default": "'2.9' is the latest version." }, "cacheName": { "type": "string", "description": "Infinispan Cache Name if not provided default is `cache` recommended to set this." }, "maxRetries": { "type": "number", "description": "Optional number of retries for operation. Defaults to 3." }, "topologyUpdates": { "type": "boolean", "description": "Optional flag to controls whether the client deals with topology updates or not.", "default": true }, "mediaType": { "type": "string", "enum": [ "text/plain", "application/json" ], "description": "Media type of the cache contents.", "default": "text/plain" }, "dataFormat": { "type": "object", "properties": { "keyType": { "type": "string", "enum": [ "text/plain", "application/json" ], "description": "Type of the key in the cache.", "default": "text/plain" }, "valueType": { "type": "string", "enum": [ "text/plain", "application/json" ], "description": "Type of the value in the cache.", "default": "text/plain" } }, "description": "Optional data format configuration. If not provided, defaults to text/plain for both key and value." }, "servers": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "Infinispan server host." }, "port": { "type": "number", "description": "Infinispan server port (Hot Rod protocol). Defaults to `11222`." } }, "required": [ "host" ] } }, { "type": "object", "properties": { "host": { "type": "string", "description": "Infinispan server host. Defaults to `127.0.0.1`." }, "port": { "type": "number", "description": "Infinispan server port (Hot Rod protocol). Defaults to `11222`." } } } ], "description": "Infinispan server host and port configuration. If this is an array, the client will connect to all servers in the list based on TOPOLOGY_AWARE routing. If this is a single object, it will be used as the default server." }, "authentication": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Enable authentication. Defaults to `false`." }, "saslMechanism": { "type": "string", "description": "Select the SASL mechanism to use. Can be one of PLAIN, DIGEST-MD5, SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-384, SCRAM-SHA-512, EXTERNAL, OAUTHBEARER" }, "userName": { "type": "string", "description": "userName for authentication." }, "password": { "type": "string", "description": "Password for authentication.", "visibility": "secret" }, "token": { "type": "string", "description": "The OAuth token. Required by the OAUTHBEARER mechanism.", "visibility": "secret" }, "authzid": { "type": "string", "description": "The SASL authorization ID." } } }, "ssl": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Enable ssl connection. Defaults to `false`.", "default": false }, "secureProtocol": { "type": "string", "description": "Optional field with secure protocol in use.", "default": "TLSv1_2_method" }, "trustCerts": { "type": "array", "items": { "type": "string" }, "description": "Optional paths of trusted SSL certificates." }, "clientAuth": { "type": "object", "properties": { "key": { "type": "string", "description": "Optional path to client authentication key" }, "passphrase": { "type": "string", "description": "Optional password for client key" }, "cert": { "type": "string", "description": "Optional client certificate" } } }, "sniHostName": { "type": "string", "description": "Optional SNI host name." }, "cryptoStore": { "type": "object", "properties": { "path": { "type": "string", "description": "Optional crypto store path." }, "passphrase": { "type": "string", "description": "Optional password for crypto store." } }, "description": "Optional crypto store configuration." } }, "description": "TLS/SSL configuration." }, "clusters": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Optional Cluster name" }, "servers": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "Infinispan cluster server host." }, "port": { "type": "number", "description": "Infinispan server port (Hot Rod protocol). Defaults to `11222`." } }, "required": [ "host" ] }, "description": "Cluster servers details. Array." } }, "required": [ "servers" ] }, "description": "Optional additional clusters for cross-site failovers. Array." } }, "description": "Configuration for the Infinispan cache store." } }, "required": [ "store" ] } ], "description": "Cache connection configuration, select cache type using the `store` field" }, "cors": { "type": "object", "properties": { "origin": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "methods": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "allowedHeaders": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "exposedHeaders": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "credentials": { "type": "boolean" }, "maxAge": { "type": "number" }, "preflightContinue": { "type": "boolean" }, "optionsSuccessStatus": { "type": "number" } } }, "csp": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "boolean", "const": false } ] }, "description": "Content Security Policy options.\n\nThe keys are the plain policy ID, e.g. \"upgrade-insecure-requests\". The values are on the format that the helmet library expects them, as an array of strings. There is also the special value false, which means to remove the default value that Backstage puts in place for that policy." }, "referrer": { "type": "object", "properties": { "policy": { "type": "array", "items": { "type": "string" } } }, "required": [ "policy" ], "description": "Referrer Policy options" }, "health": { "type": "object", "properties": { "headers": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional headers to always include in the health check response.\n\nIt can be a good idea to set a header that uniquely identifies your service in a multi-service environment. This ensures that the health check that is configured for your service is actually hitting your service and not another.\n\nFor example, if using Envoy you can use the `service_name_matcher` configuration and set the `x-envoy-upstream-healthchecked-cluster` header to a matching value." } }, "description": "Options for the health check service and endpoint." }, "metrics": { "type": "object", "properties": { "plugin": { "type": "object", "additionalProperties": { "type": "object", "properties": { "meter": { "type": "object", "properties": { "name": { "type": "string", "description": "Custom meter name. If not set, defaults to backstage-plugin-{pluginId}." }, "version": { "type": "string", "description": "Version for the meter." }, "schemaUrl": { "type": "string", "description": "Schema URL for the meter." } }, "description": "Meter configuration for this plugin." } } }, "description": "Plugin-specific metrics configuration. Each plugin can override meter metadata." } }, "description": "Options for the metrics service." }, "tracing": { "type": "object", "properties": { "capture": { "type": "object", "properties": { "endUser": { "type": "boolean", "description": "When true, backend plugins emitting trace spans for authenticated requests SHOULD include the authenticated principal's identity as `enduser.id` (the user entity ref for a user principal, or the service subject for a service principal). Defaults to false." } }, "description": "Opt-in capture of attributes that may identify users or contain sensitive data on backend trace spans." }, "plugin": { "type": "object", "additionalProperties": { "type": "object", "properties": { "tracer": { "type": "object", "properties": { "name": { "type": "string", "description": "Custom tracer name. If not set, defaults to backstage-plugin-{pluginId}." }, "version": { "type": "string", "description": "Version for the tracer." }, "schemaUrl": { "type": "string", "description": "Schema URL for the tracer." } }, "description": "Tracer configuration for this plugin." } } }, "description": "Plugin-specific tracing configuration. Each plugin can override tracer instrumentation scope metadata." } }, "description": "Tracing-related backend configuration. Honored by Backstage backend plugins that emit OpenTelemetry trace spans." }, "logger": { "type": "object", "properties": { "level": { "type": "string", "enum": [ "debug", "info", "warn", "error" ], "description": "Configures the global log level for messages.\n\nThis can also be configured using the LOG_LEVEL environment variable, which takes precedence over this configuration.\n\nDefaults to 'info'." }, "meta": { "type": "object", "additionalProperties": { "anyOf": [ { "$ref": "#/definitions/c9ec172d88f32bdaa4045dcca64065d29644f0edd852e3a9331460900f463afe-alias--747-883--0-11512049365262" }, { "type": "object", "properties": { "length": { "type": "number" } }, "required": [ "length" ], "description": "A type representing all allowed JSON array values." }, { "type": [ "number", "string", "boolean", "null" ], "description": "A type representing all allowed JSON primitive values." } ], "description": "A type representing all allowed JSON values." }, "description": "Additional metadata to include with every log entry." }, "overrides": { "type": "array", "items": { "type": "object", "properties": { "matchers": { "type": "object", "additionalProperties": { "anyOf": [ { "$ref": "#/definitions/c9ec172d88f32bdaa4045dcca64065d29644f0edd852e3a9331460900f463afe-alias--747-883--0-11512049365262" }, { "type": "object", "properties": { "length": { "type": "number" } }, "required": [ "length" ], "description": "A type representing all allowed JSON array values." }, { "type": [ "number", "string", "boolean", "null" ], "description": "A type representing all allowed JSON primitive values." } ], "description": "A type representing all allowed JSON values." }, "description": "Conditions that must be met to override the log level.\n\nA matcher can be:\n\n- A string (exact match or regex pattern delimited by slashes, e.g. `/pattern/`)\n- A non-string value (compared by strict equality)\n- An array of matchers (returns true if any matcher matches)" }, "level": { "type": "string", "enum": [ "debug", "info", "warn", "error" ], "description": "Log level to use for matched entries." } }, "required": [ "matchers", "level" ] }, "description": "List of logger overrides.\n\nCan be used to configure a different level for logs matching certain criterias. For example, it can be used to ignore 'info' logs of given plugins." } }, "description": "Options to configure the default RootLoggerService." }, "rateLimit": { "anyOf": [ { "type": "boolean", "const": true }, { "type": "object", "properties": { "store": { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "redis" }, "connection": { "type": "string" } }, "required": [ "type", "connection" ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "memory" } }, "required": [ "type" ] } ] }, "global": { "type": "boolean", "description": "Enable/disable global rate limiting. If this is disabled, plugin specific rate limiting must be used." }, "window": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "Time frame in milliseconds or as human duration for which requests are checked/remembered. Defaults to one minute." }, "incomingRequestLimit": { "type": "number", "description": "The maximum number of connections to allow during the `window` before rate limiting the client. Defaults to 5." }, "passOnStoreError": { "type": "boolean", "description": "Whether to pass requests in case of store failure. Defaults to false." }, "ipAllowList": { "type": "array", "items": { "type": "string" }, "description": "List of allowed IP addresses that are not rate limited. Defaults to [127.0.0.1, 0:0:0:0:0:0:0:1, ::1]." }, "skipSuccessfulRequests": { "type": "boolean", "description": "Skip rate limiting for requests that have been successful. Defaults to false." }, "skipFailedRequests": { "type": "boolean", "description": "Skip rate limiting for requests that have failed. Defaults to false." }, "plugin": { "type": "object", "additionalProperties": { "type": "object", "properties": { "window": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." } ], "description": "Time frame in milliseconds or as human duration for which requests are checked/remembered. Defaults to one minute." }, "incomingRequestLimit": { "type": "number", "description": "The maximum number of connections to allow during the `window` before rate limiting the client. Defaults to 5." }, "passOnStoreError": { "type": "boolean", "description": "Whether to pass requests in case of store failure. Defaults to false." }, "ipAllowList": { "type": "array", "items": { "type": "string" }, "description": "List of allowed IP addresses that are not rate limited. Defaults to [127.0.0.1, 0:0:0:0:0:0:0:1, ::1]." }, "skipSuccessfulRequests": { "type": "boolean", "description": "Skip rate limiting for requests that have been successful. Defaults to false." }, "skipFailedRequests": { "type": "boolean", "description": "Skip rate limiting for requests that have failed. Defaults to false." } } }, "description": "Plugin specific rate limiting configuration" } } } ], "description": "Rate limiting options. Defining this as `true` will enable rate limiting with default values." }, "reading": { "type": "object", "properties": { "allow": { "type": "array", "items": { "type": "object", "properties": { "host": { "type": "string", "description": "A host to allow outgoing requests to, being either a full host or a subdomain wildcard pattern with a leading `*`. For example `example.com` and `*.example.com` are valid values, `prod.*.example.com` is not. The host may also contain a port, for example `example.com:8080`." }, "paths": { "type": "array", "items": { "type": "string" }, "description": "An optional list of paths. In case they are present only targets matching any of them will are allowed. You can use trailing slashes to make sure only subdirectories are allowed, for example `/mydir/` will allow targets with paths like `/mydir/a` but will block paths like `/mydir2`." } }, "required": [ "host" ] }, "description": "A list of targets to allow outgoing requests to. Users will be able to make requests on behalf of the backend to the targets that are allowed by this list." } }, "description": "Configuration related to URL reading, used for example for reading catalog info files, scaffolder templates, and techdocs content." } }, "required": [ "baseUrl", "database" ] }, "discovery": { "type": "object", "properties": { "endpoints": { "type": "array", "items": { "type": "object", "properties": { "target": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "internal": { "type": "string" }, "external": { "type": "string" } } } ], "description": "The target base URL to use for the given set of plugins. Note that this needs to be a full URL including the protocol and path parts that fully address the root of a plugin's API endpoints." }, "plugins": { "type": "array", "items": { "type": "string" }, "description": "Array of plugins which use that target base URL.\n\nThe special value `*` can be used to match all plugins." } }, "required": [ "target", "plugins" ] }, "description": "A list of target base URLs and their associated plugins." } }, "required": [ "endpoints" ], "description": "Options used by the default discovery service." } }, "required": [ "app" ], "definitions": { "c9ec172d88f32bdaa4045dcca64065d29644f0edd852e3a9331460900f463afe-alias--747-883--0-11512049365262": { "type": "object", "additionalProperties": { "anyOf": [ { "$ref": "#/definitions/c9ec172d88f32bdaa4045dcca64065d29644f0edd852e3a9331460900f463afe-alias--747-883--0-11512049365262" }, { "type": "object", "properties": { "length": { "type": "number" } }, "required": [ "length" ], "description": "A type representing all allowed JSON array values." }, { "type": [ "number", "string", "boolean", "null" ], "description": "A type representing all allowed JSON primitive values." } ], "description": "A type representing all allowed JSON values." }, "description": "A type representing all allowed JSON object values." } } }, "packageName": "@backstage/backend-defaults" }, { "path": "../../plugins/events-node/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "events": { "type": "object", "properties": { "useEventBus": { "type": "string", "enum": [ "never", "always", "auto" ], "description": "Whether to use the event bus API in the events plugin backend to distribute events across multiple instances when publishing and subscribing to events.\n\nThe default is 'auto', which means means that the event bus API will be used if it's available, but will be disabled if the events backend returns a 404.\n\nIf set to 'never', the events service will only ever publish events locally to the same instance, while if set to 'always', the event bus API will never be disabled, even if the events backend returns a 404." } } } } }, "packageName": "@backstage/plugin-events-node" }, { "path": "../../plugins/auth-backend-module-google-provider/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "auth": { "type": "object", "properties": { "providers": { "type": "object", "properties": { "google": { "type": "object", "additionalProperties": { "type": "object", "properties": { "clientId": { "type": "string" }, "clientSecret": { "type": "string", "visibility": "secret" }, "callbackUrl": { "type": "string" }, "additionalScopes": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "signIn": { "type": "object", "properties": { "resolvers": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "resolver": { "type": "string", "const": "emailMatchingUserEntityAnnotation" }, "dangerouslyAllowSignInWithoutUserInCatalog": { "type": "boolean" } }, "required": [ "resolver" ] }, { "type": "object", "properties": { "resolver": { "type": "string", "const": "emailLocalPartMatchingUserEntityName" }, "allowedDomains": { "type": "array", "items": { "type": "string" } }, "dangerouslyAllowSignInWithoutUserInCatalog": { "type": "boolean" } }, "required": [ "resolver" ] }, { "type": "object", "properties": { "resolver": { "type": "string", "const": "emailMatchingUserEntityProfileEmail" }, "dangerouslyAllowSignInWithoutUserInCatalog": { "type": "boolean" } }, "required": [ "resolver" ] } ] } } }, "required": [ "resolvers" ] }, "sessionDuration": { "anyOf": [ { "type": "object", "properties": { "years": { "type": "number" }, "months": { "type": "number" }, "weeks": { "type": "number" }, "days": { "type": "number" }, "hours": { "type": "number" }, "minutes": { "type": "number" }, "seconds": { "type": "number" }, "milliseconds": { "type": "number" } }, "description": "Human friendly durations object." }, { "type": "string" } ] } }, "required": [ "clientId", "clientSecret" ] }, "visibility": "frontend" } } } }, "description": "Configuration options for the auth plugin" } } }, "packageName": "@backstage/plugin-auth-backend-module-google-provider" }, { "path": "../integration-aws-node/config.d.ts", "value": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "aws": { "type": "object", "properties": { "accountDefaults": { "type": "object", "properties": { "roleName": { "type": "string", "description": "The IAM role to assume to retrieve temporary AWS credentials" }, "partition": { "type": "string", "description": "The AWS partition of the IAM role, e.g. \"aws\", \"aws-cn\"" }, "region": { "type": "string", "description": "The STS regional endpoint to use when retrieving temporary AWS credentials, e.g. \"ap-northeast-1\"" }, "externalId": { "type": "string", "description": "The unique identifier needed to assume the role to retrieve temporary AWS credentials", "visibility": "secret" }, "webIdentityTokenFile": { "type": "string", "description": "Path to a file on disk containing an OIDC web-identity token." } }, "description": "Defaults for retrieving AWS account credentials" }, "mainAccount": { "type": "object", "properties": { "accessKeyId": { "type": "string", "description": "The access key ID for a set of static AWS credentials", "visibility": "secret" }, "secretAccessKey": { "type": "string", "description": "The secret access key for a set of static AWS credentials", "visibility": "secret" }, "profile": { "type": "string", "description": "The configuration profile from a credentials file at ~/.aws/credentials and a configuration file at ~/.aws/config." }, "region": { "type": "string", "description": "The STS regional endpoint to use for the main account, e.g. \"ap-northeast-1\"" } }, "description": "Main account to use for retrieving AWS account credentials" }, "accounts": { "type": "array", "items": { "type": "object", "properties": { "accountId": { "type": "string", "description": "The account ID of the target account that this matches on, e.g. \"123456789012\"" }, "accessKeyId": { "type": "string", "description": "The access key ID for a set of static AWS credentials", "visibility": "secret" }, "secretAccessKey": { "type": "string", "description": "The secret access key for a set of static AWS credentials", "visibility": "secret" }, "profile": { "type": "string", "description": "The configuration profile from a credentials file at ~/.aws/credentials and a configuration file at ~/.aws/config." }, "roleName": { "type": "string", "description": "The IAM role to assume to retrieve temporary AWS credentials" }, "partition": { "type": "string", "description": "The AWS partition of the IAM role, e.g. \"aws\", \"aws-cn\"" }, "region": { "type": "string", "description": "The STS regional endpoint to use when retrieving temporary AWS credentials, e.g. \"ap-northeast-1\"" }, "externalId": { "type": "string", "description": "The unique identifier needed to assume the role to retrieve temporary AWS credentials", "visibility": "secret" }, "webIdentityTokenFile": { "type": "string", "description": "Path to a file on disk containing an OIDC web-identity token." } }, "required": [ "accountId" ] }, "description": "Configuration for retrieving AWS accounts credentials" } }, "description": "Configuration for access to AWS accounts" } } }, "packageName": "@backstage/integration-aws-node" } ], "backstageConfigSchemaVersion": 1 }